Subject: [OAUTH-WG] I-D Action: draft-ietf-oauth-dpop-05.txt

From: [email-masked]
Date: Sat, 19 Feb 2022 12:42:14 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Web Authorization Protocol WG of the IETF.

        Title           : OAuth 2.0 Demonstrating Proof-of-Possession at the Application Layer (DPoP)
        Authors         : Daniel Fett
                          Brian Campbell
                          John Bradley
                          Torsten Lodderstedt
                          Michael Jones
                          David Waite
	Filename        : draft-ietf-oauth-dpop-05.txt
	Pages           : 42
	Date            : 2022-02-19

Abstract:
   This document describes a mechanism for sender-constraining OAuth 2.0
   tokens via a proof-of-possession mechanism on the application level.
   This mechanism allows for the detection of replay attacks with access
   and refresh tokens.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-oauth-dpop/

There is also an HTML version available at:
https://www.ietf.org/archive/id/draft-ietf-oauth-dpop-05.html

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-oauth-dpop-05

Internet-Drafts are also available by rsync at rsync.ietf.org::internet-drafts

---

From: Daniel Fett <[email-masked]>
Date: Sat, 19 Feb 2022 21:47:36 +0100

This version brings a lot of changes to DPoP, but we're also hoping to 
get closer to a final version. As usual, your feedback is appreciated!

-Daniel

Changelog:

-05

  * Added Authorization Code binding via the dpop_jkt parameter.
  * Described the authorization code reuse attack and how dpop_jkt
    mitigates it.
  * Enhanced description of DPoP proof expiration checking.
  * Described nonce storage requirements and how nonce mismatches and
    missing nonces are self-correcting.
  * Specified the use of the use_dpop_nonce error for missing and
    mismatched nonce values.
  * Specified that authorization servers use 400 (Bad Request) errors to
    supply nonces and resource servers use 401 (Unauthorized) errors to
    do so.
  * Added a bit more about ath and pre-generated proofs to the security
    considerations.
  * Mentioned confirming the DPoP binding of the access token in the
    list in Section 4.3.
  * Added the always_uses_dpop client registration metadata parameter.
  * Updated references for drafts that are now RFCs.

Am 19.02.22 um 21:42 schrieb [email-masked]:
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth